1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* audit_fsnotify.c -- tracking inodes |
3 | * |
4 | * Copyright 2003-2009,2014-2015 Red Hat, Inc. |
5 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
6 | * Copyright 2005 IBM Corporation |
7 | */ |
8 | |
9 | #include <linux/kernel.h> |
10 | #include <linux/audit.h> |
11 | #include <linux/kthread.h> |
12 | #include <linux/mutex.h> |
13 | #include <linux/fs.h> |
14 | #include <linux/fsnotify_backend.h> |
15 | #include <linux/namei.h> |
16 | #include <linux/netlink.h> |
17 | #include <linux/sched.h> |
18 | #include <linux/slab.h> |
19 | #include <linux/security.h> |
20 | #include "audit.h" |
21 | |
22 | /* |
23 | * this mark lives on the parent directory of the inode in question. |
24 | * but dev, ino, and path are about the child |
25 | */ |
26 | struct audit_fsnotify_mark { |
27 | dev_t dev; /* associated superblock device */ |
28 | unsigned long ino; /* associated inode number */ |
29 | char *path; /* insertion path */ |
30 | struct fsnotify_mark mark; /* fsnotify mark on the inode */ |
31 | struct audit_krule *rule; |
32 | }; |
33 | |
34 | /* fsnotify handle. */ |
35 | static struct fsnotify_group *audit_fsnotify_group; |
36 | |
37 | /* fsnotify events we care about. */ |
38 | #define AUDIT_FS_EVENTS (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\ |
39 | FS_MOVE_SELF) |
40 | |
41 | static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark) |
42 | { |
43 | kfree(objp: audit_mark->path); |
44 | kfree(objp: audit_mark); |
45 | } |
46 | |
47 | static void audit_fsnotify_free_mark(struct fsnotify_mark *mark) |
48 | { |
49 | struct audit_fsnotify_mark *audit_mark; |
50 | |
51 | audit_mark = container_of(mark, struct audit_fsnotify_mark, mark); |
52 | audit_fsnotify_mark_free(audit_mark); |
53 | } |
54 | |
55 | char *audit_mark_path(struct audit_fsnotify_mark *mark) |
56 | { |
57 | return mark->path; |
58 | } |
59 | |
60 | int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev) |
61 | { |
62 | if (mark->ino == AUDIT_INO_UNSET) |
63 | return 0; |
64 | return (mark->ino == ino) && (mark->dev == dev); |
65 | } |
66 | |
67 | static void audit_update_mark(struct audit_fsnotify_mark *audit_mark, |
68 | const struct inode *inode) |
69 | { |
70 | audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET; |
71 | audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET; |
72 | } |
73 | |
74 | struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len) |
75 | { |
76 | struct audit_fsnotify_mark *audit_mark; |
77 | struct path path; |
78 | struct dentry *dentry; |
79 | struct inode *inode; |
80 | int ret; |
81 | |
82 | if (pathname[0] != '/' || pathname[len-1] == '/') |
83 | return ERR_PTR(error: -EINVAL); |
84 | |
85 | dentry = kern_path_locked(pathname, &path); |
86 | if (IS_ERR(ptr: dentry)) |
87 | return ERR_CAST(ptr: dentry); /* returning an error */ |
88 | inode = path.dentry->d_inode; |
89 | inode_unlock(inode); |
90 | |
91 | audit_mark = kzalloc(size: sizeof(*audit_mark), GFP_KERNEL); |
92 | if (unlikely(!audit_mark)) { |
93 | audit_mark = ERR_PTR(error: -ENOMEM); |
94 | goto out; |
95 | } |
96 | |
97 | fsnotify_init_mark(mark: &audit_mark->mark, group: audit_fsnotify_group); |
98 | audit_mark->mark.mask = AUDIT_FS_EVENTS; |
99 | audit_mark->path = pathname; |
100 | audit_update_mark(audit_mark, inode: dentry->d_inode); |
101 | audit_mark->rule = krule; |
102 | |
103 | ret = fsnotify_add_inode_mark(mark: &audit_mark->mark, inode, add_flags: 0); |
104 | if (ret < 0) { |
105 | audit_mark->path = NULL; |
106 | fsnotify_put_mark(mark: &audit_mark->mark); |
107 | audit_mark = ERR_PTR(error: ret); |
108 | } |
109 | out: |
110 | dput(dentry); |
111 | path_put(&path); |
112 | return audit_mark; |
113 | } |
114 | |
115 | static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op) |
116 | { |
117 | struct audit_buffer *ab; |
118 | struct audit_krule *rule = audit_mark->rule; |
119 | |
120 | if (!audit_enabled) |
121 | return; |
122 | ab = audit_log_start(ctx: audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE); |
123 | if (unlikely(!ab)) |
124 | return; |
125 | audit_log_session_info(ab); |
126 | audit_log_format(ab, fmt: " op=%s path=" , op); |
127 | audit_log_untrustedstring(ab, string: audit_mark->path); |
128 | audit_log_key(ab, key: rule->filterkey); |
129 | audit_log_format(ab, fmt: " list=%d res=1" , rule->listnr); |
130 | audit_log_end(ab); |
131 | } |
132 | |
133 | void audit_remove_mark(struct audit_fsnotify_mark *audit_mark) |
134 | { |
135 | fsnotify_destroy_mark(mark: &audit_mark->mark, group: audit_fsnotify_group); |
136 | fsnotify_put_mark(mark: &audit_mark->mark); |
137 | } |
138 | |
139 | void audit_remove_mark_rule(struct audit_krule *krule) |
140 | { |
141 | struct audit_fsnotify_mark *mark = krule->exe; |
142 | |
143 | audit_remove_mark(audit_mark: mark); |
144 | } |
145 | |
146 | static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark) |
147 | { |
148 | struct audit_krule *rule = audit_mark->rule; |
149 | struct audit_entry *entry = container_of(rule, struct audit_entry, rule); |
150 | |
151 | audit_mark_log_rule_change(audit_mark, op: "autoremove_rule" ); |
152 | audit_del_rule(entry); |
153 | } |
154 | |
155 | /* Update mark data in audit rules based on fsnotify events. */ |
156 | static int audit_mark_handle_event(struct fsnotify_mark *inode_mark, u32 mask, |
157 | struct inode *inode, struct inode *dir, |
158 | const struct qstr *dname, u32 cookie) |
159 | { |
160 | struct audit_fsnotify_mark *audit_mark; |
161 | |
162 | audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark); |
163 | |
164 | if (WARN_ON_ONCE(inode_mark->group != audit_fsnotify_group)) |
165 | return 0; |
166 | |
167 | if (mask & (FS_CREATE|FS_MOVED_TO|FS_DELETE|FS_MOVED_FROM)) { |
168 | if (audit_compare_dname_path(dname, path: audit_mark->path, AUDIT_NAME_FULL)) |
169 | return 0; |
170 | audit_update_mark(audit_mark, inode); |
171 | } else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) { |
172 | audit_autoremove_mark_rule(audit_mark); |
173 | } |
174 | |
175 | return 0; |
176 | } |
177 | |
178 | static const struct fsnotify_ops audit_mark_fsnotify_ops = { |
179 | .handle_inode_event = audit_mark_handle_event, |
180 | .free_mark = audit_fsnotify_free_mark, |
181 | }; |
182 | |
183 | static int __init audit_fsnotify_init(void) |
184 | { |
185 | audit_fsnotify_group = fsnotify_alloc_group(ops: &audit_mark_fsnotify_ops, |
186 | FSNOTIFY_GROUP_DUPS); |
187 | if (IS_ERR(ptr: audit_fsnotify_group)) { |
188 | audit_fsnotify_group = NULL; |
189 | audit_panic(message: "cannot create audit fsnotify group" ); |
190 | } |
191 | return 0; |
192 | } |
193 | device_initcall(audit_fsnotify_init); |
194 | |